Fli
04-23-2014, 10:56 PM
LFD (Login Failure Daemon) can produce alot of email messages and can prevent alot of excessive ussage and attacks.
example emails:
lfd on *: Suspicious File Alert - Time: Wed Apr 23 17:49:42 2014 -0400 File: /tmp/DBD-mysql-4.027/t/52comment.t Reason: Script, starts
lfd on *: WHM/cPanel root access alert from *.*.*.*... - Time: Wed Apr 23 17:44:52 2014 -0400 IP: *.*.*.* (CZ/Czech Republic/*-*-*-*.client.
lfd on *: blocked 222.186.34.* (CN/China/-) - Time: Wed Apr 23 17:01:11 2014 -0400 IP: 222.186.34.* (CN/China/-) Failures: 5 (sshd) Interval:
lfd on *: Excessive resource usage: gedlbwxy (9459 (Parent... - Time: Wed Apr 23 16:58:26 2014 -0400 Account: gedlbwxy Resource: Virtual Memory Size Exceeded: 236
lfd on *: Excessive resource usage: ftpycxky (32311 (Paren... - Ti
So if you need to disable any of these emails, you need to edit /etc/csf/csf.conf file and then reload (restart) csf by command "csf -r"
In csf.conf search for: "EMAIL_ALERT" and then you can disable it, there are several kind of email alerts in that csf.conf.
To ignore example certain processes which trigger "Excessive resource usage", try this topic (http://internetlifeforum.com/reseller-hosting/1839-csf-mailman-bin-qrunner-exceeded-120-60-seconds-runtime-update/).
example emails:
lfd on *: Suspicious File Alert - Time: Wed Apr 23 17:49:42 2014 -0400 File: /tmp/DBD-mysql-4.027/t/52comment.t Reason: Script, starts
lfd on *: WHM/cPanel root access alert from *.*.*.*... - Time: Wed Apr 23 17:44:52 2014 -0400 IP: *.*.*.* (CZ/Czech Republic/*-*-*-*.client.
lfd on *: blocked 222.186.34.* (CN/China/-) - Time: Wed Apr 23 17:01:11 2014 -0400 IP: 222.186.34.* (CN/China/-) Failures: 5 (sshd) Interval:
lfd on *: Excessive resource usage: gedlbwxy (9459 (Parent... - Time: Wed Apr 23 16:58:26 2014 -0400 Account: gedlbwxy Resource: Virtual Memory Size Exceeded: 236
lfd on *: Excessive resource usage: ftpycxky (32311 (Paren... - Ti
So if you need to disable any of these emails, you need to edit /etc/csf/csf.conf file and then reload (restart) csf by command "csf -r"
In csf.conf search for: "EMAIL_ALERT" and then you can disable it, there are several kind of email alerts in that csf.conf.
To ignore example certain processes which trigger "Excessive resource usage", try this topic (http://internetlifeforum.com/reseller-hosting/1839-csf-mailman-bin-qrunner-exceeded-120-60-seconds-runtime-update/).